CVE-2025-15673 in Import and export users and customers Plugin
Summary
by MITRE • 08/03/2026
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability exists within the Import and export users and customers WordPress plugin version 2.4.2 and earlier, where the plugin fails to properly validate file paths during CSV import operations. This flaw allows authenticated users with sufficient privileges to manipulate the file path parameter and access arbitrary files on the underlying server filesystem. The issue stems from inadequate input sanitization and path validation mechanisms that do not properly restrict the scope of files that can be read during the import process. Attackers with high-privileged user accounts can exploit this weakness to extract sensitive data including configuration files, database credentials, and other potentially harmful information stored on the server.
This vulnerability represents a classic path traversal attack vector that falls under CWE-22 - Improper Limitation of a Pathname to a Restricted Directory. The flaw enables unauthorized file access through the plugin's CSV import functionality, where user-supplied file paths are directly processed without proper validation or sanitization. The lack of proper path restriction means that attackers can navigate beyond the intended import directory and access files anywhere on the server filesystem. This type of vulnerability is particularly dangerous in web applications because it can lead to information disclosure, system compromise, and potential further exploitation through the exposure of sensitive configuration data.
The operational impact of this vulnerability is significant for WordPress installations using the affected plugin version. High-privileged users including administrators or editors with import capabilities can leverage this flaw to extract confidential information from the server. The attack surface includes not only user data but also potentially sensitive system files, wp-config.php containing database credentials, and other configuration files that could aid in further compromise. This vulnerability can be exploited for reconnaissance purposes, allowing attackers to gather intelligence about the target environment and identify additional attack vectors. The exposure of server-side file contents can lead to privilege escalation opportunities and complete system compromise.
Mitigation strategies should focus on immediate patching of the affected plugin to version 2.4.3 or later where the path validation has been properly implemented. Organizations should also implement network-level restrictions to limit access to administrative interfaces and ensure that only trusted users have import privileges. Additional defensive measures include implementing proper input validation, using whitelisting approaches for file paths, and monitoring import operations for suspicious activity. The vulnerability aligns with ATT&CK technique T1078 - Valid Accounts and T1566 - Phishing, as it can be exploited through compromised administrative credentials to gain unauthorized access to server files. Regular security audits should verify that all WordPress plugins are updated to their latest versions and that proper access controls are in place to prevent privilege escalation attacks.